Server-Side Request Forgery in OpenAPI Generator by OpenAPITools
CVE-2023-27162

9.1CRITICAL

Key Information:

Vendor

Openapi-generator

Status
Openapi Generator
Vendor
CVE Published:
31 March 2023

What is CVE-2023-27162?

The OpenAPI Generator, up to version 6.4.0, has been identified to have a Server-Side Request Forgery (SSRF) vulnerability. This flaw exists within the /api/gen/clients/{language} endpoint, allowing attackers to exploit the system by sending malicious API requests. If successfully executed, an attacker could gain unauthorized access to internal network resources and potentially sensitive information, highlighting the need for enhanced security measures when interacting with API endpoints.

References

https://github.com/OpenAPITools/openapi-generator
https://notes.sjtu.edu.cn/s/2_yki_2Xq
https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.